Court Finds Social Network Add-On Violated Spam, Hacking Laws

In a potentially troublesome decision, a federal district court has found that a start-up violated anti-spam and computer crime laws by creating and marketing a browser to let users view their social networking accounts in one place. The case demonstrates the difficulties facing those who seek to empower users to interact with closed services like Facebook in new and innovative ways.

In Facebook v. Power Ventures, Facebook sued a small company that created a tool for users to access and aggregate their personal information across social networking sites. In 2010, the court ruled that Power didn't access Facebook "without permission" under California computer crime law when it violated Facebook's terms of use, agreeing with arguments we raised in an amicus brief (pdf).

Unfortunately, the latest round of the case has taken a downward turn in ways that could have serious implications for other innovators and users.

First, the court gave a tremendous cudgel to Facebook against commercial users who displease it when it decided that Power violated the federal CAN-SPAM Act by sending "misleading" messages. These messages encouraged users to send Facebook "Event" invitations to their friends to promote Power's service. As EFF pointed out in an amicus brief (pdf), though, the allegedly "misleading" elements of the message are supplied by Facebook itself—and can't be changed by users. This means that any user who sends a commercial message on Facebook is technically in violation of the law, since it appears to come from Facebook. The CAN-SPAM Act, passed in 2003, simply doesn't contemplate closed systems where the service provider controls many elements of a message.

To make matters worse, the CAN-SPAM Act only allows service providers to bring lawsuits, and it lets them seek crippling damages. Here, Facebook sought over $18 million. This is a clear example of a law vulnerable to misuse because technology has changed since it was written, and it wasn't even written a decade ago. EFF will be watching how Facebook and other services with closed messaging systems use CAN-SPAM in the future.

Second, the court found that Power violated state and federal computer crime laws merely by designing its tool to connect to Facebook using multiple IP addresses, which preemptively thwarted Facebook's efforts to keep users from accessing their Facebook accounts though the Power website. This precedent is especially troubling because these laws have both civil and criminal penalties. EFF is concerned that this precedent could be used in the future to criminalize the creation of tools that are capable of bypassing technological barriers, even if they are never actually used to do so, forcing innovators to anticipate every technical block that any interoperable system or program might possibly impose. This is an unworkable rule.

Facebook's case against Power is dangerous as a matter of policy, threatening to put the power of law—including serious criminal penalties—behind Facebook's anti-competitive decision to thwart consumer choice and innovation that doesn't meet its approval. It doesn't bode well for the future and should encourage all of us to think more seriously about the collateral problems created by closed networks.

Related Updates

Back in early 2013, the podcasting community was freaking out. A patent troll called Personal Audio LLC had sued comedian Adam Carolla and was threatening a bunch of smaller podcasters. Personal Audio claimed that the podcasters infringed U.S. Patent 8,112,504, which claims a “system for disseminating media content”...

The newest version of the Music Modernization Act, S. 2823, added in provisions from the bill known as CLASSICS, turning a largely great bill into a bad one. We have to tell the Senate to reject this version of the bill. S. 2823 was introduced by Sen. Orrin Hatch...

Certain reports and publications from U.S. government agencies, such as those of the Congressional Research Service, have become important reference works due to their reputation for being relatively in-depth, up to date, and factual. The United States Trade Representative's (USTR) Special 301 Report [PDF], the latest annual edition...

In one of the most important patent decisions in years, the Supreme Court has upheld the power of the Patent Office to review and cancel issued patents. This power to take a “second look” is important because, compared to courts, administrative avenues provide a much faster and more efficient means...

The Patent Trial and Appeal Board has issued a ruling [PDF] invalidating claims from US Patent No. 6,690,400, which had been the subject of the June 2016 entry in our Stupid Patent of the Month blog series. The patent owner, Global Equity Management (SA) Pty Ltd. (GEMSA)...

A New Hampshire state court has dismissed a defamation suit filed by a patent owner unhappy that it had been called a “patent troll.” The court ruled [PDF] that the phrase “patent troll” and other rhetorical characterizations are not the type of factual statements that can be the basis...

Facebook’s first reactions to the Cambridge Analytical headlines looked very different from the now contrite promises Mark Zuckerberg made to the U.S. Congress this week. Look closer, though, and you'll see a theme running through it all. The message coming from Facebook’s leadership is not about how it has failed...

EFF has been writing about the upcoming European Digital Single Market directive on copyright for a long time now. But it's time to put away the keyboard, and pick up the phone, because the proposal just got worse—and it's headed for a crucial vote on June 20-21. For those...

The general rule in patent law is that each country has its own patent system. If you want damages for sales in the United States, you need a U.S. patent. If you want damages for sales in New Zealand, you need to get a New Zealand patent, and so on...

In a surprising decision that should terrify software developers, the Federal Circuit held today that Google’s use in its Android mobile operating system of Java API labels infringed Oracle’s copyright. Rejecting the jury verdict, the district court’s holding, and established law, the appellate court held that Google’s use was not...